How To: Configure a Split Profile Provider

Version Affected: All

 

Overview

This article explains how to configure Split Profile Providers, so that a realm's Membership Connection (used for authentication) and Profile Connection (used for profile attributes) can use different data store types without their attribute mappings tripping over each other.

Data coming from more than one source can cause profile attributes to conflict if the realm isn't configured for this. Splitting the Profile Provider from the Membership Connection allows for a more uniform, predictable attribute mapping when both are in use.

You may use whichever data store types fit your use case for Membership Connection Settings and Profile Provider Settings. This example uses Active Directory for Membership Connection Settings and SQL Server for Profile Provider Settings.

Configure a Split Profile Provider

1. Go to the Data tab. Set up Membership Connection Settings as Active Directory, as you normally would, and test that it works, as shown below.

2. Under Profile Provider Settings, change Same As Above to False and change Default Profile Provider to SQL Server, then save, as shown below.

3. Under Profile Connection Settings, set Data Server to SQL Server. Configure the SQL Server data store type, then test to confirm it works, and save, as shown below.

4. Change Data Server from SQL Server back to Directory Server, and configure the Directory Server data store type to match your Membership Connection Settings — it may already be configured correctly by default. Test and save, as shown below. Leave it configured this way.

With this configuration, Membership Connection Settings and Profile Connection Settings are both mapped to the same directory server. The Profile Provider Settings still use SQL Server as the Default Profile Provider, because that configuration is still in place in the web.config — both the SQL Server and Active Directory setups remain configured for the Profile Connection Settings.

Special Considerations

On IdP 24.04 (vanilla), a known defect can cause the Profile section's service account to revert to the Membership section's value when you save the Data tab. See Bug: Profile Service Account Reverts to the Membership Value on a Split Profile Realm for the workaround; this is fixed in 24.4.3 RU and later.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.